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REMARKS 

The Examiner has rejected Claims 1-4, 9-12, 13-16, 21-24, 25-28, and 33-36 
under 35 U.S.C. 102(e) as being anticipated by Abu-Husein (U.S. Patent No. 6,895,506). 
Applicant respectfully disagrees with such rejection, especially in view of the 
amendments made hereinabove to the independent claims. Specifically, applicant has 
amended the independent claims to at least substantially include the subject matter of 
former dependent Claims 5-8 et al. 

With respect to the independent claims, the Examiner has relied on Col. 2» line 50 
to Col. 3, line 4, and Col. 6, line 53 to CoL 8, line 10 in Abu-Husein to make a prior art 
showing of applicant's claimed technique ""wherein said loader program is operable to * . . 
nigger execution of said computer program as loaded into said computer memory by said 
loader program" (see this or similar, but not necessarily identical language in the 
independent claims). 

Applicant respectfully asserts that the excerpts from Abu-Husein relied upon by 
the Examiner teach that "[t]he loader/decrvption mechanism is responsive to direction of 
the memory manager for writing the un-encrypted version of the pro p ;ram code into the 
memory for execution bv the processor, wherein the processor is responsive to die 
writing of the un-encrvpted version of the program code into the memory for executing 
the un-encrypted version of the program code to perform the requested operation" (CoL 
2, lines 60-67 - emphasis added). In addition, Abu-Husein teaches that "LoadPecrvot 
28 will write the decoded Program 18 code into Memory 12C as directed by Memory 
Manager 30A and at locations determined bv Memory Manager 3 0A, where the Program 
1 8 code will be executed bv Processor 12A to perform the requested operation*' (Col 8, 
lines 5-1 0 - emphasis added). Clearly, merely disclosing that the Load/Decrypt writes 
the un-encrypted program to memory locations determined by the Memory Manager fails 
to even suggest a technique '^vherein said loader nrogram is operable to . . . tri|gper 
execution of said computer program as loaded into said computer memory by said loader 
program'^ (emphasis added), as claimed by applicant. Clearly, the excerpts from Abu- 
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Husein fail to disclose a loader progran^ that triggers the execution of a computer 
program^ as claimed. 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegaal Bros, v. Union Oil Co, Of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987), Moreover, the identical invention must be 
shown in as complete detail as contained in the claim, Richardson v. Suzuki Motor 
Ca868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 1989). The elements must be 
arranged as required by the claim. 

This criterion has simply not been met by the above reference, as noted above. 
Nevertheless, despite such paramount deficiencies and in fhe spirit of expediting the 
prosecution of the present application, applicant has incorporated the subject matter of 
foimer Claims 5-8 et al. into the independent claims. 

With respect to the subject matter of former Claim 6 et al. (now at least 
substantially incoiporated into the independent claims), the Examiner has rejected the 
same under 35 U.S.C. 103(a) as being unpatentable over Abu-Husein in view of 
Nachenberg (U*S. Patent No. 5,826,013). Specifically, the Examiner has relied on the 
following excerpt from the Nachenberg reference to make a prior art showing of 
applicant's claimed technique ''wherein said malwaie scanning computer program is 
operable such that once executed, said malware scanning computer program scans said 
loader program for malware" (see this or similar, but not necessarily identical language in 
the independent claims). 

*^Xn accordance with the present invention, the atatio exclusion 
modulQ (230) examines the gross chaxaet eristics of the target 
file for attributes that are inccndi^tent with the mutation 
engine specific data for known poXymcrphic irirusee (150) . These 
characteristicis are the type of target file, the size of the 
target file's load image, the presence of certain instructions at 
the file entry point, and the distance between the file entry 
point and the end of the load image. The last characteristic is 
useful because most viruses append themselves to the files they 
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infect. In some cases, the static exclusion module (230) allows 
certain target files to be identified ae infected without any 
emulation. 

The dynamic exclusion module (240) examines the 
instruct ion/ interrupt usage profiles (224) of each known 
polymorphic virus (150) as each instruction is fetched for 
emulation. The instruction/interrupt usage profiles (224) 
indicate which polymorphic viruses (150) employ mutation engines 
that do not use the fetched instruction in decryption loops they 
generate, and the emulation control module (220) flags these 
viruses. The emulation control module (220) continues until all 
mutation engines have been flagged or until a threshold number of 
instructions have been emulated. The flagging technique 
implemented by the dynamic exclusion siodule (240) determines wlien 
erttulation has proceeded to a point where at least some code from 
the decrypted static virus body (160) may be scanned and 
substantially reduces the number of instructions emulated prior 
to scanning the remaining target files without resort to booster 
or stopper heuri sties . " (Nachenberg, Col^ 3/ lines 25-53 - 
emphasis added) 



Applicant respectfully asserts that the excerpt from Nachenberg relied upon by 
the Examiner merely discloses that "the static exclusion module (230) examines the gross 
characteristics of the target file for attributes that are inconsistent with the mutation 
engine specific data for known polymoiphic viruses." In addition, Nachenberg discloses 
that "at least some code from the decrypted static virus body (160) may be scanned.** 
Clearly, teaching the examination of the target file for attributes that ai^ inconsistent with 
the mutation engine specific data for known polymoiphic viruses and that some code of 
decrypted static virus body may be scanned clearly fails to even suggest a technique 
'Svherein said malware scanning computer program is operable such that once executed^ 
said malwaie scanning computer pro-am scans said loader program for malware" 
(emphasis added), as claimed by applicant The excerpt from Nachenberg simply fails to 
even suggest that a loader program is scanned for malware once a malware scanning 
computer program is executed. 



Further, with respect to the subject tnatter of fomier Claim 7 et al. (now at least 
substantially incorporated into the independent claims), the Examiner has rejected the 
same under 35 U.S.C. 103(a) as being unpatentable over Abu-Husein in view of 
Nachenberg. Specifically, die Examiner has relied on the following excerpt from the 
Nachenberg reference to make a prior art showing of applicant's claimed technique 
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^'wherein, if said loader program is detected as being infected with said malware, then 
said malware scanning cony)uter program is operable to repair said loader program or 
replace said loader program with a clean copy of said loader program" (see this or 
similar, but not necessarily identical language in the independent claims, as amended). 



"^Once the emiilaclon phase has been terminated, scanning aazi begin 
on decrypted static virus body 1€0 or at least those parts 
decrypted by the first 1.5 million instructions. In order to 
facilitate scanning of static virus body 160/ emulation control 
module 220 keeps track of which locations of virtual memory are 
most likely to be infected, in particular, emulation control 
module 220 tags the page or pages of virtual memory containing an 
instruction executed by emulator 210 4 In addition, every time an 
emulated instruction writes to memory/ the altered pages are 
tagged as containing modifiad data. Tagged pages in virtual 
memory are scanned for signatures of static virus body 160 as 

follows : 

(1) if a page contains executed code, it and the following page 
are scanned 

(2) if a page has been written to during emulation and more than 
a threshold number of memory writes occurred anywhere in memory 
during emulation, the modified page and the following page are 
scanned," (Nachenbergr Col. a, lines 50-67 - emphasis added) 

Applicant respectfully asserts that the excerpt from Nachenberg relied upon by 
the Examiner merely discloses tiiat "every time an emulated instniodon writes to 
memory, the altered pages are tagged as containing modified data." Further, Nachenberg 
teaches that "[t]agged pages in virtual memory are scanned for signatures of static virus 
body.** However, merely scanning tagged pages in virtual memory feils to even suggest a 
technique ''wherein, if said loader program is detected as being infected with said 
malware, then said malware scanning computer program is operable to repair said loader 
program or replace said loader program with a clean copy of said loader program" 
(emphasis added), as claimed by applicant 



To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
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expectation of success. Finally, liie prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck 947 F,2d 488, 20 USPQ2d 
1438(Fed.Cir.l991), 

Appellant respectfully asserts that at least the third element of the prima faci^ 
case of obviousness has not been met» since the prior art references, v\^en combined, fail 
to teach or suggest all of the claim limitations, as noted above. Thus, a notice of 
allowance or specific prior art showing of each of the foregoing claim elements, in 
combination with the remaining claimed features, is respectfully requested. 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. For example, with respect to Claim 10 et al., the Exammer has relied 
on the following excerpt firom the Abu-Husein reference to make a prior art showing of 
applicant's claimed technique ''i^erein said computer program is operable to terminate 
said loader program when said computer program is triggered to execute by said loader 
program.** 

''Finally, it must be noted that, as well understood by those of 
ordinary skill in the relevant arte, the execution of a Process 
16 in or by a PU 12 is conducted in an operating environment that 
is generally referred to as a "context". The context in which a 
Process 16 is executed includes, for example, the current 
operating state of the system, the current execution state of the 
Process 16 and the program the Process 16 is executing, and so 
on. in general, and typically, each Process 16 is executed in a 
corresponding context and the execution of a different Process 16 
involves or requires a change of the system operating context to 
another context corresponding to the new Process 16. Such changes 
in context, which are often referred to as "context switches" or 
**context swaps" ^ may occur, for example/ when a Process 16 must 
call another Process 16 for an operation or has been completed or 
when the processor "time slice" allocated to a Process 16 has 
ended and the processor is to he allocated to the execution of a 
different Process 16." (Abu-Husein, Col. 9, line 65 to Col, 9, 
line 15 - emphasis added] 
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Applicant respectfully asserts that the excerpt from Abu-Husein relied upon by 
the Examiner merely discloses that "'context switches" ... may occur ... when a Process 
16 must call another Process 16 for an operation or has been completed or when the 
processor "time slice" allocated to a Process 16 has ended and the processor is to be 
allocated to the execution of a different Process 1 6/ Clearly, the concept of 'time slices" 
and "context switches" simply fails to even suggest a technique "herein said computer 
program is operable to terminate said loader program when said computer program is 
triggered to execute by said loader program^ (emphasis added), as claimed by applicant 

Further, with respect to Claim 1 1 et al., the Examiner has relied on Col. 9, lines 
16-50 from the Abu-Husein reference to make a prior art showing of applicant's claimed 
technique ''wherein said loader program is operable to load said computer program into a 
memory space withm said computer memory separate from a memory space used by said 
loader program.^' Applicant respectfully asserts that excerpt from Abu-Husein relied 
upon by the Examiner merely discloses a method of performing a "context switch." 
Specifically, Abu-Husein discloses a context switch where **the execution of the currently 
executing Process 16 is suspended and the storage space in Memory 12C is reassigned by 
the Memory Manager 30A to accommodate the programs and data of the new Process 
16«" Additionally, Abu-Husein teaches that the context of the current process is saved 'to 
allow the execution of the Process 16 to be resumed at the point it was suspended when 
the Process 16 is "switched" or "swapped" in and again becomes the Process 16 currently 
being executed.' However, merely disclosing a context switch fails to even suggest a 
technique '^vherein said loader program is operable to load said computer program into a 
memory space within said computer memory separate from a memorv space used bv said 
loader program" (emphasis added), as claimed by applicant, 

Agaiiu a notice of allowance or specific prior art showing of each of the foregoing 
claim elements, in combination with the remaining claimed features, is respectfully 
requested. 
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Still yet, applicant brings to Ihe Examiner's attention the subject matter of new 
Claims 37-39 below, which are added for full consideration: 

"wherein^ as a first task, said malware scanning computer program scans 
said loader program for said malware" (see Claim 37); 

"whmin, if said loader program is detected as being infected with said 
malwaie, then said malware scanning computer program is operable to replace 
said loader program with a clean copy of said loader program" (see Claim 38); 
and 

"wherein, if said loader program is detected as being infected with said 
malware, then said malware scanning computer program is operable to repair said 
loader program" (see Claim 39), 

Yet again, a notice of allowance or specific prior art showmg of each of the 
foregoing claim elements, in combination with the remaining claimed features, is 
respectfully requested. 

Thus, aU of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telqjhone conversation would expedite the prosecution of this 
application, the Exammer may reach the undersigned at (408) 505-5100. The 
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Conunissioner is authorized to charge any additional fees or credit any oveipayment to 
Deposit AcoountNo. 50-1351 (Order No. NAI1P481). 



P.O. Box 721 120 
SanJose.CA 95172-1120 
408-505-5100 
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